wayid-verify is a relying-party SDK for checking the WayID of an AI agent at your gateway, reverse proxy, or API backend. WayID binds a verified human or business identity to the agents they run; this SDK lets your service answer "what kind of agent is calling me?" in one call, with no user-facing flow and no cryptography to operate yourself.
An agent identifies itself with a WayID: wayid:agent:{24-char-base58} request header. The SDK extracts the header, resolves it through the public GET {issuer}/api/v1/agent/{did} endpoint, caches the result, and applies a policy. By default it fails open: a verifier outage or unknown DID never blocks the request, which is served and tagged unknown.
The v1 header is self-asserted, so it proves that the named DID exists and is owner-verified, not that the caller holds the agent's private key. Cryptographic proof-of-possession built on Web Bot Auth (RFC 9421 HTTP Message Signatures) is planned as a v2 layer.
Features
- TypeScript package: @lineagelabs/wayid-verify with Express and Cloudflare Worker adapters
- Python package: wayid-verify (Python 3.9+, standard library only) with FastAPI/Starlette and Flask adapters
- Fail-open default: unresolved or unreachable identities are tagged rather than rejected
- Result caching: resolved DIDs are cached so the issuer is not called on every request
- Companion NGINX integration: an njs-based edge handler lives in the separate wayid-nginx project
- Prototype status: the wire contract is defined in the way-id product and tech specs, and both packages are tag-driven but not yet published to npm or PyPI